Signal / 004 — Tailcat opens a tunnel without the tailnet

SYSVOID SIGNAL // HOMELAB // OCTOBER 1, 2026

Tailscale has released Tailcat, an open-source Go package and command-line tool for making an encrypted connection between machines without first creating an account, joining a tailnet, or exposing an IP address.

A tunnel without the control plane

Tailcat takes the useful network plumbing from Tailscale’s data plane—WireGuard encryption, NAT traversal, and DERP relay fallback—and packages it into something closer to netcat. One machine starts a listener and generates a shareable Tailcat address. Another machine uses that address to connect.

The software attempts a direct peer-to-peer connection. If the networks on both ends will not cooperate, traffic can fall back to a relay. It runs in userspace, so it does not need root access, create a TUN device, or rewrite the host’s routing table.

Built for temporary access

Tailscale positions Tailcat for short-lived jobs: moving files, reaching a development box, forwarding a port, connecting a game session, or giving a sandboxed agent temporary access to specific hardware. That narrow scope is the point.

There is an important boundary. Tailcat deliberately leaves out user identity, centralized policy, auditing, and device management. Its address grants access and should be handled like a password—not logged, committed to a repository, or posted publicly. Tailscale also says its hosted relay keeps metadata logs and is not intended for privacy or high-throughput workloads; operators can run their own DERP relay instead.

The sysVoid take

Opinion: Tailcat is compelling because it does less. A permanent mesh is excellent infrastructure, but sometimes the edge case is simply two shells that need a temporary encrypted path. Escape the default network stack—carefully.

AI-assisted summary based on Tailscale’s official announcement and Tailcat documentation. No hands-on testing was performed.